Data Processing Agreement

1. Subject matter and duration

The subject matter is the provision of Hullwise to the customer under the Terms and the respective order (main agreement): external checks of websites, history, monitoring, subdomain search, REST API, MCP server and, if ordered, the Security Audit.

This agreement applies for as long as the provider processes personal data for the customer. It ends with the main agreement. Obligations to delete and return data under section 10 continue to apply.

2. Nature and purpose of the processing

Nature: collecting, storing, querying, matching, transmitting by email and deleting.

Purposes:

• Checking the websites the customer specifies and creating the reports
• Storing history and monitored sites in the customer's account
• Email notifications, for example when a grade gets worse
• Access to the API and the MCP server with API keys
• Protecting the service against misuse

3. Types of personal data

• Email addresses of the accounts
• Domains and hosts that are checked or monitored
• Scan results: report, grade, score, time and source of the scan. They contain keys found only in shortened form (beginning and last characters), never their full value.
• IP addresses for misuse protection (in-memory counter, expires after one hour) and in the hosting logs
• API keys as a SHA-256 hash with name, prefix and time of last use
• Audit orders: domain, email address and processing status

The customer enters payment data directly with Stripe. It is not covered by this agreement.

4. Categories of data subjects

• Employees and agents of the customer who use an account or an API key
• Persons to whom checked domains or publicly served content of the checked websites relate, insofar as this is personal data

5. Technical and organisational measures

The provider implements the measures under Art. 32 GDPR described under Security and Privacy. They form part of this agreement in the version valid at the time of conclusion.

The provider may develop the measures further as long as the level of protection does not decrease. It documents material changes on that page.

6. Subprocessors

The customer approves the following subprocessors:

DPF means the EU-U.S. Data Privacy Framework. The Standard Contractual Clauses are those of the European Commission under Decision 2021/914. Sources are linked under Service providers. Stripe processes some data as an independent controller.

If the provider wants to add or replace a subprocessor, it informs the customer in text form at least [14] days in advance. The customer may object for an important reason under data protection law. The provider contractually binds every subprocessor to a level of protection equivalent to this agreement.

7. Instructions

The provider processes the data only on documented instructions from the customer, unless a legal obligation requires otherwise. Instructions are the main agreement, this agreement and the settings the customer makes in the account. The customer gives further instructions in text form.

If the provider considers an instruction unlawful, it informs the customer without undue delay (Art. 28(3), third sentence, GDPR). It may suspend execution until the customer confirms or changes the instruction.

8. Confidentiality

The provider only uses persons who are bound to confidentiality or are subject to a statutory duty of secrecy. This duty continues after this agreement ends.

9. Assistance to the customer

• The provider assists the customer in responding to requests from data subjects under Art. 12 to 23 GDPR. If a request reaches the provider, it forwards it without undue delay.
• It assists with the obligations under Art. 32 to 36 GDPR, that is security, notification of personal data breaches, data protection impact assessment and prior consultation.
• It notifies the customer of a personal data breach without undue delay and no later than [48] hours after becoming aware of it, with the information under Art. 33(3) GDPR as far as available.

10. Deletion and return

After the services end, the provider deletes all of the customer's data or, at the customer's choice, returns it, for example the history as a file. This does not apply where a statutory retention obligation exists, for example for invoices. Copies in backups are deleted within [insert period].

On request, the provider confirms the deletion in text form.

11. Audit rights

The provider makes available to the customer the information necessary to demonstrate compliance with this agreement. It allows audits by the customer or by an auditor appointed by the customer who is bound to confidentiality.

The customer announces on-site audits at least [14] days in advance. They take place during business hours and must not disrupt operations disproportionately. For subprocessors, their reports, certificates or audit evidence are sufficient.

12. Liability

Liability towards data subjects is governed by Art. 82 GDPR. Between the parties, the liability provisions of the Terms apply.

13. Final provisions

• In the event of conflict, this agreement takes precedence over the main agreement in matters of data protection.
• Amendments and additions must be made in text form.
• If a provision is invalid, the remainder stays valid.
• German law applies. Place of jurisdiction is [Frankfurt am Main], to the extent permitted by law.

Signatures